Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash
values without properly restricting the ability to trigger hash collisions
predictably, which allows context-dependent attackers to cause a denial of
service (CPU consumption) via crafted input to an application that
maintains a hash table, as demonstrated by a universal multicollision
attack against the MurmurHash3 algorithm, a different vulnerability than
CVE-2012-2739.

 jdstrand> no 2.3 update as of 2013/12/20. 2.4/armhf needs to be fixed
 jdstrand> the MurmurHash3 was introduced in OpenJDK 7 7u9-2.3.3 and OpenJDK 6
  6b24-1.11.5 as part of the fix for CVE-2012-2739.
 jdstrand> icedtea-web not affected (code not present)
 jdstrand> patches/security/20121016/7158800.patch introduced this (ie
  murmur3_32())
 jdstrand> per comment #1 in https://bugzilla.redhat.com/show_bug.cgi?id=880705
  SipHash-2-4 is not vulnerable
 sbeattie> purported to be fixed in 7u40